Latest Cybersecurity News and Articles

---

Chinese PostalFurious Gang Strikes UAE Users with Sneaky SMS Phishing Scheme

A Chinese-speaking phishing gang dubbed PostalFurious has been linked to a new SMS campaign that's targeting users in the U.A.E. by masquerading as postal services and toll operators, per Group-IB. The fraudulent scheme entails sending users bogus text messages asking them to pay a vehicle trip fee to avoid additional fines. The messages also contain a shortened URL to conceal the actual

---

Zyxel Firewalls Under Attack! Urgent Patching Required

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday placed two recently disclosed flaws in Zyxel firewalls to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities, tracked as CVE-2023-33009 and CVE-2023-33010, are buffer overflow vulnerabilities that could enable an unauthenticated attacker to cause a

---

49% of organizations proactively invest in identity protection

A new report reveals that 89% of businesses are somewhat or very concerned that new privacy regulations will impact identity security at their organization.

---

Security leaders plan for changing IT roles

IT professionals find themselves in hybrid roles that combine traditional development with tasks formerly associated with operations professionals.

---

Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text

The database was exposed on May 16, 2023. Researchers identified the exposure on May 25, 2023, and since then, the information has remained exposed. Currently, the server holds over 100,000 customer records, totaling 400 GB in size.

---

66% of organizations have increased their investment in SaaS apps

According to a survey, 58% of organizations estimate their current SaaS security solutions only cover 50% or less of their SaaS applications.

---

Windows 11 to require SMB signing to prevent NTLM relay attacks

Microsoft says SMB signing (aka security signatures) will be required by default for all connections to defend against NTLM relay attacks, starting with today's Windows build (Enterprise edition) rolling out to Insiders in the Canary Channel.

---

Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards

The issue, disclosed last week by firmware and hardware security company Eclypsium, is that the firmware of more than 270 Gigabyte motherboards drops a Windows binary that is executed at boot-up to fetch and execute a payload from Gigabyte’s servers.

---

Online sellers targeted by new information-stealing malware campaign

Online sellers are being targeted in a new campaign launched this week to push the Vidar information-stealing malware, allowing threat actors to steal credentials for more damaging attacks.

---

Australian cyber-op attacked ISIL with zero-click exploit

The documentary, BREAKING the CODE: Cyber Secrets Revealed, reveals that the Australian Signals Directorate developed three payloads it could deploy to ISIL fighters' smartphones and PCs "without ISIL having to interact with the device in any way."

---

Update: Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations

Mandiant has attributed the attack to UNC4857, a new threat cluster, and named the delivered webshell LemurLoot. Microsoft, on the other hand, is confident that the threat actor behind the Cl0p ransomware is responsible for the attack.

---

A new wave of sophisticated digital fraud hits Europe

Forced verification and deepfake cases multiply at alarming rates in the UK and continental Europe, according to Sumsub. In Germany alone, forced verification grew by 1500% as a proportion of all fraud cases to 5% of all fraud in Q1 2023.

---

Brazilian Cybercriminals Using LOLBaS and CMD Scripts to Drain Bank Accounts

The attack chain primarily leverages social engineering, banking on Portuguese and Spanish emails containing tax- or traffic violation-themed lures to trigger the infections and gain unauthorized access to victims' systems.

---

Zyxel published guidance for protecting devices from ongoing attacks

Zyxel has published guidance for protecting firewall and VPN devices from ongoing attacks exploiting the CVE-2023-28771, CVE-2023-33009, and CVE-2023-33010 vulnerabilities.

---

Magento, WooCommerce, WordPress, and Shopify Exploited in Web Skimmer Attack Campaign

Cybersecurity researchers have unearthed a new ongoing Magecart-style web skimmer campaign that's designed to steal personally identifiable information (PII) and credit card data from e-commerce websites.

---

The Hidden Menace of the Terminator Antivirus Killer

A threat actor was discovered promoting a tool called Terminator that can reportedly bypass 24 antivirus, EDR, and XDR solutions. However, Crowdstrike found that it uses a Bring Your Own Vulnerable Driver (BYOVD) attack. Presently, the vulnerable driver used by Terminator is only being identified by a solitary anti-malware scanning engine, as indicated by a VirusTotal scan. 

---

Cybercriminals Exploit Legitimate Websites for Credit Card Theft

A new Magecart-style skimming campaign has been spotted in the wild wherein threat actors host their malicious codes on legitimate sites and inject malicious code on e-Commerce sites in the next phase of the attack. To further enhance the stealthiness of their attack, the threat actors have employed Base64 encoding to obfuscate the credit card skimmer. 

---

Cybercriminals use legitimate websites to obfuscate malicious payloads

Cybersecurity experts are grappling with new strategies that surpass conventional domain-based inspection methods, with a growing focus on exploiting legitimate business tools like SharePoint and other trusted sources to deliver attacks.

---

Play Ransomware Groups Claims to Steal Confidential Data From Large Spanish Bank

The Play ransomware group claimed this week that it attacked the bank and stole an undisclosed amount of private and personal confidential data, client and employee documents, passports, contracts, and more.

---

OpenAI Unveils Million-Dollar Cybersecurity Grant Program

OpenAI said projects in scope include those that collect and label data from cyber defenders to train defensive cybersecurity agents; detect and mitigate social engineering tactics; automate incident triage, and identify security issues in code.